Fault-tolerant control systems are typically implemented as redundant systems comprising duplicates of various important modules/devices. In case an important module/device fails its functionality is taken over by a similar module/device.
EP 2 080 903 A1 discloses a fail-safe control system for wind turbine applications. According to EP 2 080 903 A1 a first control unit performs so-called critical control functions, whereas a second, and separate, control unit performs so-called non-critical control functions. The first and second control units are coupled to each other via a network. EP 2 080 903 A1 discusses the disadvantages associated with redundant wind turbine control systems, where critical control units are doubled. However, as specified in [0014] of EP 2 080 903: “Further, control functions of the first set may also be redundantly included in the second set, to provide graceful degradation within the overall control system.”
US 2009/0309360 and US 2009/0309361 discuss a method and a system for controlling a wind energy park. In US 2009/0309360 and US 2009/0309361 a main communication unit controls a number of prioritised control units. In case a given control unit with a given priority fails, the main communication unit selects a lower prioritised control unit to take over the functionality of the defective control unit.
It is a disadvantage of the method and system suggested in US 2009/0309360 and US 2009/0309361 that the main communication unit selects which control unit to take over in case another control unit breaks down or in any other way malfunctions. However, in case the main communication unit itself breaks down, no replacement unit is available. Thus, the control method and the control system suggested in US 2009/0309360 and US 2009/0309361 can not be considered a fault-tolerant control method/system—at least not on the main communication unit level.
It may be seen as an object of embodiments of the present invention to provide a fault-tolerant wind turbine control system.